PT-2024-6709 · Gitlab · Gitlab Ce/Ee+1

Joaxcaron

·

Published

2024-09-26

·

Updated

2024-10-04

·

CVE-2024-4099

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.0 through 17.2.7 GitLab EE versions 17.3 through 17.3.3 GitLab EE versions 17.4 through 17.4.0
Description: An issue has been discovered in GitLab EE affecting the AI feature, which reads unsanitized content. This could have allowed an attacker to hide prompt injection, potentially impacting data integrity. The vulnerability is related to a lack of output encoding or sanitization mechanism in the AI feature of the GitLab platform.
Recommendations: For GitLab EE versions 16.0 through 17.2.7, update to version 17.2.8 or later. For GitLab EE versions 17.3 through 17.3.3, update to version 17.3.4 or later. For GitLab EE versions 17.4 through 17.4.0, update to version 17.4.1 or later. As a temporary workaround, consider disabling the AI feature until a patch is available. Restrict access to the AI feature to minimize the risk of exploitation. Avoid using the AI feature in sensitive environments until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2024-07922
CVE-2024-4099

Affected Products

Gitlab
Gitlab Ce/Ee